The Swiss canton of Vaud says unauthorised access, detected on 2026-10-26, to the IT-support platform of its Gymnases and professional schools copied the names, school e-mail addresses and support requests of about 3,500 teachers and 38,000 pupils; passwords are not stored on the platform and no grades or pupil files are affected (Etat de Vaud, 2026-10-31). The canton names targeted fraudulent messages that pose as the school or IT support as the main risk, and RTS reports, from the canton's latest information, that everything points to a pupil, with no context, reason or objective known (Etat de Vaud, 2026-10-31; RTS, 2026-10-31, translated from French); the canton gives no access method, actor or platform product.
The names, first names and school e-mail addresses of about 3,500 teachers and 38,000 pupils were copied, as was the content of support requests. (translated from French)
The main risk for the people concerned is the receipt of targeted fraudulent messages posing as the school or IT support. (translated from French)
Etat de Vaud
According to the latest information given by the State of Vaud, everything points to the theft having been committed by a pupil. (translated from French)
The takeaway said CloudSOC SpanVA and CASMA have no fix; Broadcom's umbrella advisory lists none as of 2026-10-30, but their own advisories need a login, so the statement now says what the umbrella page shows.
The takeaway said CloudSOC SpanVA and CASMA have no fix. Broadcom's umbrella advisory 39404, last revised on 2026-10-30, lists both as affected and states no fix or workaround, while their own product advisories, 39429 and 39475, need a Broadcom login, so the absence of a fix is what the umbrella page shows, not a confirmed state (Broadcom, 2026-10-30).
The sibling flaw CVE-2026-110264 reaches every GitLab version from 7.0, with backports to 19.1.9, 19.0.10 and 18.11.13, so instances older than 19.2 are in scope and have a fixed build; the Ruby project says any application that compiles attacker-controlled regular expressions is exposed until Ruby 4.0.9, 3.4.12 or 3.3.13.
GitLab's notes of 2026-10-21 give the sibling flaw CVE-2026-110264 a wider range than this one: every GitLab CE/EE version from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9 and 19.2 to 19.5 before their October 21 builds, with the fix backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 (GitLab, 2026-10-21). An instance on a branch older than 19.2 is therefore not out of scope and has a fixed build to move to. The Ruby project says the regular-expression engine bugs behind these CVEs are reached whenever an application compiles a regular expression from a string an attacker controls, fixes all of them in Ruby 4.0.9, 3.4.12 and 3.3.13, and advises avoiding compiling regular expressions from untrusted input where an upgrade is not possible (Ruby, 2026-10-23).
Broadcom's revisions of 2026-08-03 and 2026-08-19 (the 8.0 U2f express patches and the 7.0 extended-support path) are now in the fixed builds and actions; the Infosecurity Magazine attribution and date are corrected, CISA's ransomware-use flag on CVE-2026-59310 is recorded, the network attack vector of the two lower-severity flaws and the researcher credit are fixed, and the headline is current.
Broadcom revised the advisory twice after first publication: on 2026-08-03 (VMSA-2026-0006.1) the vCenter 8.0 U2f and ESX 8.0 U2f express patches became available, and on 2026-08-19 (VMSA-2026-0006.2) it added patch guidance for the 7.0 lines, where vCenter and ESX 7.0 customers are told to contact Broadcom Support under an extended support contract (Broadcom, 2026-08-19). The fixed-build statements above now include those paths. Broadcom scores CVE-2026-41703 and CVE-2026-41709 with a network attack vector that needs high privileges, and credits Maxim Suhanov by name (Broadcom, 2026-08-19).
The 2026-08-28 section said Infosecurity Magazine reported the same assessment as The Hacker News; its article of 2026-08-13 reports only QUIRSO's earlier assessment of a suspected APT actor and predates the China-nexus and Babuk findings (Infosecurity Magazine, citing QUIRSO GmbH, 2026-08-13). CISA's catalog now marks CVE-2026-59310 as known to be used in ransomware campaigns, without naming an actor or a ransomware family (CISA KEV, 2026-10-30), so the ransomware finding no longer rests on QUIRSO alone.
Morphisec reports PHP2Shell post-exploitation on a Windows server running IIS with PHP-CGI (the IIS worker starting php-cgi.exe, a command shell and a packed reverse-shell payload), the first such account it knows of; Siemens now points APE1808 operators to the available PAN-OS versions, and The Hacker News carries Unit 42's retraction.
Morphisec reports blocking post-exploitation on a customer's Windows server running IIS with PHP-CGI, where the IIS worker process w3wp.exe started the PHP-CGI handler php-cgi.exe, which ran a command shell that launched a packed payload; the payload used shellcode to load networking libraries and tried to open a reverse shell to an external server (Morphisec, 2026-10-28). Morphisec ties the chain to the PHP flaws but says its agent did not detect the PHP exploitation itself, and it describes one customer; it says every earlier confirmed exploitation report described a Linux environment (Morphisec, 2026-10-28). On Windows, the process signal is therefore php-cgi.exe under w3wp.exe starting cmd.exe or other executables.
Siemens' advisory for RUGGEDCOM APE1808 devices, at version 1.1 of 2026-10-28, now tells operators to upgrade to the corresponding available PAN-OS version and to contact customer support for further patch information (Siemens ProductCERT, 2026-10-28). The Hacker News has added a note to its 2026-10-25 article recording Unit 42's retraction (The Hacker News, 2026-10-25). Hunt.io puts watchTowr's report of exploitation of both flaws on its honeypots on 2026-10-21 earliest, ahead of Karimi's honeypot report (Hunt.io, 2026-10-28).
Microsoft added Microsoft Edge to the fix list for the exploited Windows Shell flaw on 2026-10-26, with Edge 154.0.4258.62 as the fixed build; estates that pin Edge versions should confirm they are at or above it.
Microsoft revised the CVE record on 2026-10-26 to add Microsoft Edge (Chromium-based) to its security updates table, with 154.0.4258.62 as the fixed build, and encourages customers running a supported Edge version to update to it (Microsoft Security Response Center, 2026-10-26). That Edge stable build was released on 2026-10-05 (Microsoft Learn, 2026-10-05), so an Edge that updates automatically already carries it; an estate that pins or defers Edge versions should confirm it. Microsoft does not say how Edge is involved in the bypass.
Bern's ICSG and IDSV are in force from 1 November 2026 and the old ISDS DV lapses; KAIO now expects the Grundschutz BE baseline directive in the first quarter of 2027, with its AGB ISDS BE terms to be agreed in cantonal contracts that cover processing information or personal data. Communes are bound wherever they process cantonal or federal information, use cantonal or federal ICT resources or process personal data.
The ICSG and its ordinance IDSV are in force from 1 November 2026, and the former directorate ordinance on information security and data protection (ISDS DV) lapses the same day (Kanton Bern KAIO, 2026-10-30). KAIO's page, as changed on 2026-10-30, says the baseline directive Grundschutz BE, which defines the protection requirements for cantonal authorities, is expected to enter into force in the first quarter of 2027, and that the existing directive ICSGW stays valid until then. Annex 4 of Grundschutz BE holds the canton's general terms on information security and data protection (AGB ISDS BE, version of 27 October 2026), which the cantonal administration must agree as part of contracts whose subject is the processing of information or personal data, so suppliers of the canton should expect them in new contracts. The incident-reporting platform is still announced without details. Communes and other public-task carriers are bound to the extent that they process cantonal or federal information, use cantonal or federal ICT resources or process personal data (Kanton Bern KAIO, 2026-10-30).
GitGuardian counts at least 72,026 further GhostAction commits to 22,964 repositories between 13 and 21 October from mostly the same unrevoked accounts, and new payloads that reach developer machines through a hidden VS Code task outside GitHub's workflow hold, query cloud metadata and AWS roles, and install a cron job that survives cleaning the repository.
GitGuardian's analysis of 2026-10-27 counts, as lower bounds from its own feed, 72,026 commits from the operator to 22,964 public repositories between 13 and 21 October, 7,989 of them new victims, pushed by 1,792 accounts of which 1,382 had already pushed the 8 October payload: the tokens stolen earlier were never revoked (GitGuardian, 2026-10-27). The campaign now ships five payload families and reaches beyond GitHub-hosted runners. One family is a Node.js stealer disguised as a font file and launched by a hidden VS Code task that runs when a developer opens the folder and trusts the workspace; it reads cloud, package-registry, Git, Kubernetes and AI-tool credential files, SSH keys and token-bearing environment variables, and since no workflow is involved, GitHub's workflow hold does not stop it. Self-hosted-runner workflows query the cloud instance metadata service for role credentials, and the revived 2025 workflow requests a GitHub OIDC token and tries to assume every AWS IAM role found in the environment (GitGuardian, 2026-10-27). Three families install a cron job that fetches and runs a script from the operator's server every five minutes, so a developer laptop or runner that ran one stays under control after the repository is cleaned. GitGuardian found no successful run of the workflow payloads, which GitHub's hold caught (GitGuardian, 2026-10-27). Between 22 and 26 October, loaders of a separate campaign, PolinRider, were added to GhostAction commits and force-pushed; GitGuardian sees no clear link between the two operators (GitGuardian, 2026-10-27). It warns against reverting the attacker's "Update" commits, which restores the previous malicious version, and has seen re-infection where tokens were kept after a clean-up (GitGuardian, 2026-10-27).
The fixed versions given for CVE-2026-114148 named runtime releases 10.0.14 and 11.0.0-rc.3; Microsoft's advisory fixes the ASP.NET Core tarballs in 8.0.33 and 9.0.22 and the source-built distributions in SDK releases 8.0.133, 9.0.123, 10.0.114, 10.0.403 and 11.0.100-rc.3. The process-crash signal in the Detection line now rests on JFrog's .NET reproduction.
For CVE-2026-114148, the incorrect file ownership in Linux tarballs, Microsoft's advisory names the fixed packages as the ASP.NET Core 8 and 9 runtime and targeting-pack tarballs 8.0.33 and 9.0.22 and, for source-built Linux distributions, SDK releases 8.0.133, 9.0.123, 10.0.114, 10.0.403 and 11.0.100-rc.3; it lists no 10.0.14 or 11.0.0-rc.3 fix for this flaw (dotnet/announcements #495, 2026-10-25). JFrog reproduced a .NET runtime crash through Brotli decompression, the process-crash signal the Detection line names (JFrog, 2026-10-25).
An earlier section's statement that no source reported exploitation outside the laboratory is dated to the day it held; NCSC Switzerland now rates the flaw actively exploited, and Zscaler's first-day decoy telemetry joins ELLIO's. Datadog's detection layers (decoder errors, worker crashes, leaked decompressed output) and what does not catch the attack are added, as is Palo Alto's Prisma Cloud Transporter Client.
The 2026-10-26 section's statement that no source reported exploitation outside Imperva's laboratory held only for that day: CISA listed the flaw as exploited on 2026-10-27, and NCSC Switzerland's advisory, updated on 2026-10-29, now gives the status as actively exploited with a proof of concept available (NCSC Switzerland, 2026-10-26). ELLIO's capture is not the only attack telemetry: Zscaler's decoys recorded 402 events from 20 source addresses against 12 customers within a day of disclosure, 60% of them exploitation attempts and the rest reconnaissance (Zscaler ThreatLabz, 2026-10-28).
Datadog, which reproduced the bug, finds no conventional indicators because no attacker infrastructure is involved and lays out three layers to correlate (Datadog, 2026-10-29): decoder errors, where a vulnerable Node.js build returns Z_BUF_ERROR "unexpected end of file" (which benign truncated input also produces) and a patched one ERR__ERROR_FORMAT_BLOCK_SWITCH; process signals, a worker exiting with signal 139 right after a Brotli transfer or pinned at full CPU inside a decompression call; and decompressed output carrying bytes the client never sent, the memory-disclosure path, so endpoints that echo or reflect decompressed content are the ones to check first. Payload byte signatures, WAF content matching and body-size limits do not catch it, because the WAF forwards compressed bytes and the middleware counts decompressed size (Datadog, 2026-10-29). Palo Alto's advisory also lists Prisma Cloud Application Security Transporter Client before 0.2.9 as affected, fixed in 0.2.9 (Palo Alto Networks, 2026-10-29).
CIQ released patched kernels for RLC Pro LTS 9.6, 9.2 and 8.6 and the FIPS 9.6 and 9.2 variants on 2026-10-31 and lists the stable backports 5.10.272, 5.15.223, 6.1.190 and 6.6.159; Ubuntu and Red Hat kernels were still unfixed, and Red Hat now scores the flaw 9.8.
CIQ released patched kernels on 2026-10-31 for RLC Pro LTS 9.6 and FIPS 9.6 (kernel-5.14.0-570.60.1+27.2.el9_6_ciq), LTS 9.2 and FIPS 9.2 (kernel-5.14.0-284.30.1+45.1.el9_2_ciq) and LTS 8.6 (kernel-4.18.0-372.32.1+40.1.el8_6_ciq); RLC Pro LTS 8.10 and RLC Pro 10 are still waiting, and CIQ says the same fix was backported to the stable series 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 (CIQ, 2026-10-31). Ubuntu's tracker, last updated 2026-10-30, still lists its kernels as vulnerable with fixes in progress (Canonical, 2026-10-30), and Red Hat's page now gives a preliminary CVSS 3.1 score of 9.8 (Red Hat, 2026-10-31).
Wordfence assigned CVE-2026-119977 (CVSS 3.1 8.1) to the WordPress upgrade-window race after the entry was written; the statements that no CVE identifier exists are replaced and the CVE record is added.
The flaw now has an identifier: Wordfence tracks it as CVE-2026-119977, a time-of-check time-of-use race condition scored CVSS 3.1 8.1 (AV:N/AC:H/PR:N), affecting WordPress 4.7.0 to 7.1.3 with the same fixed releases as above (Wordfence Intelligence, 2026-10-31). The statement that no source assigns a CVE identifier is withdrawn; scanners and asset inventories can now match the flaw by that ID.
Belden now names NetModule NRSW 5.0.0.105 as the fix, with disabling the web interface only as the fallback; Schneider Electric added EcoStruxure Foxboro DCS H90 Server with a port-blocking mitigation, and Wibu-Systems released CodeMeter License Central 5.2.3.
Belden's advisory PSIRT-10, now at version 1.1, recommends upgrading NetModule NRSW to 5.0.0.105; disabling the web interface is the mitigation only where the upgrade is not possible, so the earlier statement that no patched NRSW release exists no longer holds (Belden, 2026-10-22). Schneider Electric's bulletin, at version 3.2.0 of 2026-10-30, added EcoStruxure Foxboro DCS H90 Server on 2026-10-28 with a mitigation only: check that firewalls block TCP ports 2301 and 2381, used by the HPE System Management Homepage (Schneider Electric, 2026-10-30). Wibu-Systems released CodeMeter License Central 5.2.3, which applies its post-update configuration recommendations automatically, and a new patch installer for 5.1.x and 5.0.x (Wibu-Systems, 2026-10-29).
Adobe's APSB26-162 of 2026-10-27 fixes eight further Critical Campaign Classic flaws in build 9402 and earlier, one of them a SQL injection that needs no privileges (CVE-2026-105781, CVSS 9.8), so build 9403 replaces 9402 as the update target. Adobe reports no exploitation.
Adobe's Priority 2 bulletin APSB26-162 of 2026-10-27 covers Campaign Classic v7 7.4.4 build 9402 and earlier on Windows and Linux and names build 9403 as the fix, so build 9402, the earlier fix, is affected (Adobe PSIRT, 2026-10-27). Its eight flaws are all rated Critical. One needs neither privileges nor user interaction: CVE-2026-105781, a SQL injection at CVSS 3.1 9.8. Four need low privileges at 9.9 (code injection CVE-2026-104351, OS command injection CVE-2026-104353, incorrect authorization CVE-2026-105780 and SQL injection CVE-2026-105489), CVE-2026-104350 is a reflected cross-site scripting flaw at 9.3 that needs user interaction, and CVE-2026-104354 and CVE-2026-105779 are SQL injections at 9.1 (Adobe PSIRT, 2026-10-27). Adobe is not aware of exploits in the wild for any of them (Adobe PSIRT, 2026-10-27). The update target for on-premise servers and the on-premise tier of hybrid deployments is now build 9403.
Dream's report, as updated on 2026-10-29, names the rooted firewalls as PAN-OS, so the 2026-10-29 section now does too and gives Dream's account of what the Active Directory attacks confirmed; the Exposure and takeaway lines now name PAN-OS management interfaces and Palo Alto's fixes. The CISA catalog statement is given in CISA's words, the root-step sentence follows Wiz's wording, and two at-disclosure sentences (Microsoft's no-exploitation statement, which the KEV listing superseded, and the early patch note) are removed.
Dream Research's report, as updated on 2026-10-29, names the rooted firewalls as Palo Alto Networks PAN-OS and the exploited surface as the PAN-OS management web server, and says the recovered artifacts confirm credential extraction and directory enumeration in the attacked Active Directory, while whether the password spray succeeded is unknown (Dream Research, 2026-10-29). Unit 42 says the PHP flaws are exploited against PAN-OS management interfaces exposed to the internet and that customers who have applied the available PAN-OS fixes are not affected (Unit 42, 2026-10-29). CISA's catalog entry says the kernel flaw can be chained with the PHP flaws to implant PHP webshells and run commands as root; it does not itself say which flaw supplies the web-server code execution (CISA KEV, 2026-10-28).
The analysis no longer says there is no exploitation signal or that the cookie name is withheld; the October 2025 release is treated as a lower bound on exposure, not its start; the CVE record's 9.4 score beside the discloser's 10.0, Membership Pro's CVSS 3.1 rating and its default-configuration impact, Balbooa's wording on web-server rules and the attribution of the read-side reading are corrected; the headline is current.
The analysis above still said there was no public exploitation signal and that the researcher withholds the cookie name; the researcher's 2026-07-29 follow-up prints the cookie and reports the follow-up batch exploited, so anything on 2.20.1 or earlier is exposed (mySites.guru, 2026-07-29). The October 2025 date is the release before the fix, not the start of exposure: the researcher says the vulnerable code shipped for at least nine months and probably far longer, and that the published CVE record scores CVE-2026-61425 9.4 on a high-privileges vector that does not match the anonymous attack it reproduced (mySites.guru, 2026-07-20). Membership Pro's CVE-2026-62415 is rated 9.1 under CVSS 3.1 and, on a default configuration, is an anonymous file write rather than code execution (mySites.guru, 2026-07-21). Balbooa's 2.20.2 notes address customers who added their own web-server rules against the attacks; they do not say Balbooa had advised them (Balbooa, 2026-07-29). The "read-side" reading of the 2.20.4.2 pair is mySites.guru's; the CNA's vector also rates integrity and availability High (mySites.guru, 2026-10-27). The compromise review now starts from 20 July, the cookie bypass's disclosure.
Python 3.15.1, 3.14.9 and 3.13.17, which the 2026-10-25 section listed as patched, predate the ssl denylist; the protected releases are 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18, and the tracker clause that carried the earlier versions is removed.
Python 3.15.1, 3.14.9 and 3.13.17 do not carry the protection: the releases whose ssl module blocks the compromised eMudhra keys are 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 (Python Insider, 2026-10-26). A host on 3.15.1, 3.14.9 or 3.13.17 still needs the later release.
The Detection line again carries Volexity's on-appliance compromise checks (the temporary directory, network and memory forensics, the Integrity Checker's blind spot), and the binding of the first two chain steps to CVE-2026-104935 is now cited to Volexity, which states it.
Volexity's compromise-assessment guidance applies after patching as well: check the appliance's /tmp directory for evidence of post-exploitation actions and, where compromise is suspected, conduct network and memory forensics, because the Ivanti Integrity Checker may not identify a compromise (Volexity, 2026-10-13). Volexity tracks the authentication bypass and code execution steps under CVE-2026-104935 (Volexity, 2026-10-13).
GreyNoise's live tracker records successful exploitation on its deliberately vulnerable sensors from 2026-10-28, with reverse shells, a .ssh directory under /var/www, cloud-metadata queries and secret-scanning tools in the sessions of 2026-10-29 and 2026-10-31; Hunt.io reports that an operator's attempt against a national government failed because session files lay outside the webroot, and relays that PAN-OS firewalls were rooted in production. Dream Research's updated report names Palo Alto Networks PAN-OS as the product behind the chain first described with an unnamed vendor, which Unit 42 says it verified.
GreyNoise's live tracker, last updated 2026-11-01 03:48 UTC, records successful exploitation on its deliberately vulnerable sensors from 2026-10-28, the first when an Apache worker spawned a shell that ran curl, and counts 1,177 confirmed exploitations from five attacker addresses, defined as sessions in which the web server ran operating-system commands (GreyNoise, 2026-11-01). The count is of shell events on sensors, not of compromised servers. The commands recorded on 2026-10-29 include bash reverse shells over /dev/tcp, creation of /var/www/.ssh, queries to the cloud metadata address and downloads of the linPEAS and gitleaks enumeration and secret-scanning tools; secret-scanning runs over /var/www/html and system directories appear in the sessions of 2026-10-31 (GreyNoise, 2026-11-01).
Hunt.io, reading open-directory captures, says shells have been confirmed only on honeypots and sensors, which it names as watchTowr, 0x4D31 and GreyNoise, and that its shared exploit kit has not been seen landing on a live victim, while relaying Dream Research's and Unit 42's account of PAN-OS firewalls rooted in production as the first confirmed production compromises; in one capture an operator who ran the chain against a national government got only a crash, because session files lay outside the webroot, and then broke in with a different bug (Hunt.io, 2026-10-28).
Dream Research updated its report on 2026-10-29 to say that the affected devices run Palo Alto Networks PAN-OS and that the operation rooted 25 PAN-OS firewall and management servers, and Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29). The earlier description of "one unnamed vendor" above is superseded.
Microsoft removed seven eMudhra-hierarchy certificates from the Windows trust list in an out-of-band update of 2026-10-26 and from the Edge trust list on 2026-10-27; Cisco's advisory reached version 1.5 on 2026-10-30 with ISE fixes dated December 2026 and April 2027; GitLab's releases of 2026-10-29 distrust the eight intermediates, with GitLab Runner and the AI Gateway needing separate updates; Python's releases of 2026-10-26 carry the built-in denylist; and Oracle's revision of 2026-10-30 extends the Java alert to Oracle Database Server, Autonomous Health Framework and OPatch. Certificates that chain to the removed roots need replacing, and disconnected Windows devices need the updated trust lists.
Microsoft released an out-of-band Windows update on 2026-10-26 that removes seven certificates associated with the affected hierarchies, six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list, and removed the same seven from the Edge trust list on 2026-10-27; removing a root is a separate and broader decision than blocking the compromised intermediates, which Microsoft had done through its Disallowed Certificate Trust List on 2026-10-20 (Microsoft, 2026-10-26). Microsoft tells organizations to keep automatic trust-list updates flowing, to make sure disconnected Windows devices receive the updated trust lists, and to replace certificates that chain to one of the seven before the change reaches their devices, and it warns that software that does not check revocation or the disallowed list could still accept certificates tied to the compromised keys if trust is restored locally (Microsoft, 2026-10-26).
Cisco's advisory is at version 1.5 of 2026-10-30. It lists remediation for Secure Firewall ASA, FTD and FMC (guidance page), Secure Email Gateway and Secure Email and Web Manager (updated automatically to Trusted Root 2.8, with the updatenow command where updates are manual) and Packaged and Unified Contact Center Enterprise (CSCwx36769); it dates the fixes for ISE and ISE-PIC to ISE 3.5P5 in December 2026 and 3.3P13 and 3.4P8 in April 2027, and still lists IOS XE Software, MDS 9000 and Nexus switches among the impacted products under investigation; Cisco says it is not aware of malicious use (Cisco PSIRT, 2026-10-30). GitLab's patch release of 2026-10-29 removes trust for the eight intermediates in self-managed CE and EE and says GitLab Runner 19.5.1 and the AI Gateway must be updated separately because they verify certificates on their own (GitLab, 2026-10-29). Python's expedited releases of 2026-10-26, 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18, now carry the built-in denylist for the compromised intermediates (Python Insider, 2026-10-26). Oracle's revision 2 of Security Alert CVE-2026-114820, dated 2026-10-30, adds the Java component of Oracle Database Server (19.3 to 19.32, 21.3 to 21.23 and 23.4.0 to 23.26.3, not client-only installations), Autonomous Health Framework Trace File Analyzer 26.3 to 26.10, OPatch 12.2.0.1.16 to 12.2.0.1.52 and Hospitality Cruise Shipboard Property Management 23.3.4 to 23.3.6, each remotely exploitable without authentication at CVSS 3.1 9.1 (Oracle, 2026-10-30).
Google Threat Intelligence Group and Mandiant report that since late August they have seen ARTEX, PentAGI and CAIRN operated inside incident-response cases, with ARTEX adopted by extortion groups and suspected PRC-nexus clusters whose victims include US government organizations; they track the Wiz-observed ARTEX campaign as UNC7228, overlapping Storm-0940, and say the original ARTEX repository was taken down in October while forks keep spreading it. The agent's log signature is bursts of roughly 2 to 25 seconds, error-driven retries and, in one case, MySQL general-log changes likely intended to write JSP web shells.
Google Threat Intelligence Group (GTIG) and Mandiant report that since late August 2026 they have seen threat actors operate ARTEX, PentAGI, CAIRN and possibly custom harnesses inside Mandiant incident-response engagements, with agents carrying out significant parts of the attack lifecycle such as lateral movement, database exploitation and exfiltration preparation (GTIG and Mandiant, 2026-10-31). They say ARTEX has been adopted since late August by financially motivated extortion groups and suspected PRC-nexus clusters, whose operations affected organizations in government, technology, chemicals and materials, and manufacturing in the United States, and that the campaign Wiz tracks, which GTIG tracks as UNC7228, overlaps with Microsoft's Storm-0940 and dates back to at least August 2026 (GTIG and Mandiant, 2026-10-31). The original ARTEX repository was taken down by its creator in October because of abuse, but community forks, among them a commercial one, keep the framework in circulation (GTIG and Mandiant, 2026-10-31).
In several cases the operators handed ARTEX compromised credentials and told it to run the later stages. GTIG's log signature for the agent is execution in bursts of roughly 2 to 25 seconds, error-driven retries and forensically noisy trial and error; in one case, given valid credentials, the framework used an application's SQL API to point the MySQL general log at a web-accessible .jsp path and then ran SELECT statements carrying script tags, likely intended to write web shells under somewhat-incremental file names until they ran cleanly (GTIG and Mandiant, 2026-10-31).
Dream Research's updated report names Palo Alto Networks PAN-OS as the product in the chain that paired the PHP2Shell flaws with this kernel flaw, and counts 25 rooted PAN-OS firewall and management servers; Unit 42 says it independently verified the tooling and results.
Dream Research updated its report on 2026-10-29 to say that the firewalls rooted with a custom PHP2Shell build chained to this kernel flaw run Palo Alto Networks PAN-OS, and counts 25 rooted PAN-OS firewall and management servers; Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29).
Dream Research's report, updated 2026-10-29, names Palo Alto Networks PAN-OS as the product behind the chain it had first described with an unnamed vendor: a custom PHP2Shell build chained with a Linux kernel flaw rooted 25 PAN-OS firewall and management servers and was followed by an attack on a US government-affiliated Active Directory, and Unit 42 says it independently verified the tooling and results. The advisory's exploitation statement is unchanged; a device that was exposed and unpatched needs a compromise check as well as the hotfix, and Dream says the affected web server also fronts the GlobalProtect portal, which Palo Alto's advisory lists as not affected.
Dream Research updated its report on 2026-10-29 to say that the affected devices run Palo Alto Networks PAN-OS; the operation it had described with an unnamed vendor rooted 25 PAN-OS firewall and management servers, and Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29). Dream's recovered artifacts show web shells left on 24 firewalls, 22 of them parked with nothing further done, and a boot-persistent tunnel into the internal network of a US government-affiliated organization that it assesses is likely still active (Dream Research, 2026-10-29). Unit 42 says customers who applied the available patches are not affected and that the management interface is not exposed to the internet by default (Unit 42, 2026-10-29). Dream also says the management web server fronts the GlobalProtect portal, which Palo Alto's advisory lists as not affected (Dream Research, 2026-10-29; Palo Alto Networks, 2026-10-30). A device that was exposed and unpatched therefore needs the compromise checks in the Detection line, not only the hotfix.
Update the PHP runtime, not the CMS or its plugins, on every internet-facing server and container image to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or to your distribution's patched package, restart PHP-FPM, Apache and every long-running worker, rebuild images, and confirm the running version, because a distribution backport can keep the old version string; isolate any application that cannot be updated from public networks until it is.
After updating, set session.upload_progress.enabled=0 on every PHP host and keep it there until PHP's next regular bugfix release: CVE-2026-115560, which the October releases do not fix, needs session upload progress to be enabled.
List every appliance and management server whose web interface embeds PHP (firewalls, network access control and security consoles), take each interface off the internet and install its vendor's PHP2Shell fix, because Dream Research reports Palo Alto Networks PAN-OS firewalls rooted through an exposed management interface.
Inventory which guest VMs use the VMXNET3 adapter and patch the ESX hosts carrying them to ESXi-9.1.0.0200, ESXi-9.0.2.0100, ESXi80U3k or ESXi80U2f: the escape is reachable from guest administrative privilege, which makes any tenant-operated or lower-trust VM on a shared host a path to the hypervisor.
Patch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k/U2f as applicable (vCenter 7.0 through Broadcom extended support), since there is no workaround, and on any appliance that was network-reachable and unpatched between 29 July and today, check the appliance's own scheduled-task and cron configuration for entries the platform team did not create, and its egress records for outbound SSH sessions from the appliance itself.
On the ESX hosts of any vCenter estate that was exposed or compromised, install the build that fixes CVE-2026-41709 and review administrator activity from vCenter task and event records and from syslog forwarded off the host, because Broadcom says the flaw lets an administrator act without being logged and CrowdStrike reports it used as a zero-day.
Inventory Joomla sites for the Balbooa Gridbox page builder and update every one to 2.20.4.2, which also closes two unauthenticated SQL injections, CVE-2026-102788 and CVE-2026-102789, and the unauthenticated blind SQL injection in the front-end blog author parameter fixed in 2.20.3.1, present in every earlier build, 2.20.3 and 2.20.2.3 included. Anything below 2.20.2 is also exposed to the exploited follow-up batch, which 2.20.1 does not close.
On any site that ran Gridbox 2.20.1 or earlier while internet-reachable, review the Super User list and administrator-group members, remove accounts that entered an admin group through self-registration rather than an explicit administrative action, and review template files and the web root for changes, with particular attention to files written since 20 July, when the cookie bypass was disclosed.
Upgrade every Belden NetModule NRSW router to 5.0.0.105, and where that is not yet possible disable its web interface after confirming SSH access, with the CLI settings http.status=0 and https.status=0; patch macmon 7.x from the service portal and move macmon 6.x to 7.x, and keep the web interfaces of both off networks that are not trusted.
Take the management interface of every PA-Series and VM-Series firewall and Panorama off the internet now by restricting it to a jump box or trusted internal addresses, because Palo Alto reports active exploitation against internet-exposed management interfaces, and install the hotfix for your maintenance release, which Palo Alto's table lists for every line from 10.2.7 to 12.2.4 (11.2.10-h17 adds the Brotli fix).
Rotate the directory bind account, HA replication keys, certificate private keys and device authentication keys of every PAN-OS firewall and Panorama that was reachable from the internet while unpatched and shows a PHP web shell or a tunnel, because the chain Dream Research recovered harvested exactly those from rooted firewalls, and the hotfix does not remove a web shell or tunnel already in place.
Deploy the 2026-10-13 cumulative update for each release (KB5127648 for Windows 11 24H2, 25H2 and 26H2, KB5127646 for Windows 11 26H1, KB5126657 for Windows 10 21H2 and 22H2, KB5126655 for Server 2022, KB5126646 for Server 2025, and the others listed in the CVE record) to every Windows endpoint and server, starting with the systems whose users open mail and chat attachments or download files; Rapid7 says Windows Server 2012 receives no patch; confirm that Microsoft Edge is at 154.0.4258.62 or later, which Microsoft added to the fix list on 2026-10-26.
On every internet-facing Linux server, install the distribution kernel that fixes CVE-2026-98432 and reboot as soon as it ships (Debian bookworm 6.1.190-1 and trixie 6.12.113-1 and CIQ's RLC Pro LTS kernels are out; Ubuntu and RHEL kernels were not as of 2026-10-31), and until then drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ describes, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path.
Update every non-browser TLS client that keeps its own CA bundle or does not check revocation to a fixed version: standalone Java runtimes, including those already updated on 2026-10-21, to the update of Oracle's Security Alert CVE-2026-114820 or OpenJDK (Oracle Database Server, Autonomous Health Framework and OPatch installations too), Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 together with pip 26.2.2 or later, Go 1.27.3 or 1.26.10, and self-managed GitLab to a fixed patch release together with GitLab Runner 19.5.1; then confirm with curl against the incident tracker's test host that the client rejects the certificate.
Replace, by hand where the ACME client does not support ACME Renewal Information, every TLS certificate your organisation holds that chains to emSign ECC Root CA - G3 or to another of the seven certificates Microsoft removed from the Windows and Edge trust lists, because Chrome's removal of the G3 root was due on 2026-10-27 and the Windows change takes effect when the trust-list update reaches a device; deliver the updated Disallowed Certificate Trust List and the trust-list changes Microsoft describes, including its out-of-band update of 2026-10-26, to Windows devices that do not receive automatic certificate-trust updates.
Apply Cisco's remediation now for the products its eMudhra advisory (version 1.5) lists with a fix or a procedure available: the guidance for Secure Firewall ASA, FTD and FMC, Secure Email Gateway and Secure Email and Web Manager (run the updatenow command where updates are manual), Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1 and ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2).
Run an organisation-scoped GitHub code search in every organisation your teams and suppliers administer for workflow files under .github/workflows that present themselves as a security audit, a security check or an Actions security workflow and were added since 2026-08-31; any hit means assume breach: revoke the credential that committed it, rotate every secret found anywhere in the repository's git history, not only the configured Actions secrets, and check the crontab of every developer machine and self-hosted runner that opened or ran the repository since 2026-10-14 for a five-minute job that runs a remote script.
Update every on-premise Adobe Campaign Classic v7 server, and the on-premise components of any hybrid deployment, to build 9403; build 9402 is affected by APSB26-162, including a SQL injection that needs no privileges, build 9401 fixes only APSB26-134's three flaws, and an Adobe-hosted instance that still reports 9401 is not evidence of exposure.
2026-11-01T1312Z-audit· audit · Opus 5.5 · window 168 h · 0 entries published
Scope and outcome
Scheduled weekly audit of 2026-10-25T13:08Z to 2026-11-01T13:12Z (anchor: the 2026-10-25 audit, the last with re-sweeps). Fifty-four entries with activity from the week's seven intel fires were truth-checked whole in six passes: 30 clean, 22 with imprecisions, 2 with factual errors. The re-sweeps found no gap that needed a new entry; six developments on covered findings were added as records. Twenty-four entries carry one record each from this fire (7 updates, 13 corrections, 4 improvements; 7 internal). Report: docs/audits/2026-11-01-quality-audit.md.
Verification & coverage notes
Claims: an open partial claim from cleanup wave 05 (2026-10-21T1147Z-audit, partial 2026-10-21T11:47:42Z wave=05) still stands on main; the scheduled audit ignores a partial claim (Phase 0 step 2), and it is more than 48 h old.
Budget: 13 of 20 spawns (six truth passes, G1 to G3, four verifier passes), 6,885,964 sub-agent tokens: 4,748,994 before the verifier loop and 2,136,970 in it (work/2026-11-01T1312Z-audit/budget.tsv).
Verification: four passes over this fire's changed claims, the run record and the report. Iterations 1 and 2 returned NEEDS_FIXES (7 and 3 truth findings), all remediated; iteration 3 returned CLEAN; iteration 4, the confirmation pass over all 242 claims, found no truth defect and two editorial ones (two cves[].affected strings not brought in line with this fire's own fixed-build additions), both applied. Decision rule 5 (truth plus editorial at most 2, no F1 or F4) publishes on that early exit; the residual is 2, the two editorial findings, which were applied after the pass and are unverified by a further pass. The pre-existing advisories left for the next truth pass are the Dream citation dates on the CVE-2026-46300 entry.
Truth passes: 54 entries in six batches, 1,651 ledger claims, every claim answered (12 unreadable in TA, mostly NetScaler's Tech Zone post that returns 403 on every transport). Verdicts: 30 clean, 22 imprecision, 2 factual error.
Records: 24 entries carry one record each (7 update, 13 correction, 4 improvement; 7 internal). The six re-sweep developments are records on covered entries; no new entry was needed.
KEV: ten additions since 2026-10-25, all covered (work/2026-11-01T1312Z-audit/kev-window.txt); no COVERED-STALE or RANSOMWARE row.
Backlog: ARX Group SA held to 2026-11-07; G2 found no victim, client or press confirmation.
borderline-drop: Adobe Campaign Classic APSB26-162 as a new entry: published instead as an update on the 2026-10-02 entry, whose fixed build it supersedes.
borderline-drop: ESET APT Activity Report Q2-Q3 2026, Talos VOLTA and NIK C2, Check Point Yoba, Elastic wesp.sys, Symantec AI relays, Group-IB MadApe, Microsoft's DPRK AI staging, Kaspersky cloud isolation, the MEP letter on ad-delivered spyware, Apple's notification wave, Zimperium's Coruna and DarkSword counts (G3): no constituency decision.
borderline-drop: Contact Form 7 6.2.4, Sophos UTM CVE-2026-118633, TeamViewer TV-2026-1011, the Drupal contrib wave of 2026-10-28, Splunk, Mitel, Jenkins, EPICS, Adobe Connect, LXD, Thales Sentinel, Teltonika, vsftpd, TightVNC, WolfVision, Grafana, the Synology SA-26:15 and Fortinet FG-IR-26-187 notices for the covered Brotli flaw (G1): unexploited, regular cycle, no constituency exposure, or a vendor notice that adds no decision to the covered entry.
borderline-drop: Sophos UTM CVE-2026-118633 (Sophos advisory 2026-10-28, pre-auth root RCE, all versions, end of life, manual patch): no exploitation or proof of concept reported, it needs the email proxy with scanning enabled and minutes of sustained racing (not a single-request path), EPSS 0.006, and the product is end of life with a manual patch as the only fix; verifier iteration 1 raised it as a missed angle (F10, low confidence) and the audit keeps the drop, to be reopened on an exploitation report.
borderline-drop: Camping.Care supplier-side statement (a Dutch campsite's notice of 2026-10-23, G2): it predates the window and adds only that the platform operator told campsites data was presumably taken, which the covered entry's incident framing already carries.
borderline-drop: SolNet, SIHF, SoftwareOne, Leipzig University, Fehmarnbelt FLC, Verrières-en-Forez, the Federal Council alerting dispatch, the e-evidence transitional rule, the Geneva e-voting step, the BACS week-43 WhatsApp wave, EFK report on ZEMIS (G2): below the incident floor or no defender consequence.
Declined truth-pass findings, with reasons in the report: Adobe Commerce Events for CVE-2026-48356, the MDaemon KEV ransomware flag (WinRAR vector), the WS_FTP CVE-2026-90867 mitigation (CVE record API only), the Gridbox high (low-confidence F16), T1611 on CVE-2026-46300, Publica's early volume statement.
Source health: sans-isc content scope set; ico-uk (timeouts), ssd-disclosure (transient) and connectwise-trust-center (flapping) investigated and left as they are; no webfetch-only record.
Reader pool (context): 6 of 10 jina keys live, balance about 46.8 M; G3 saw extract fall through to the reader seven times on Dark Reading.
ATT&CK pin: up to date (local v20.0 == upstream v20.0).
Tool change: tools/check_run.py now appends every run-scope gate output to work/<run-id>/gate.log; exercised on this fire's gate runs.
Coverage gaps: sygnia (blocked on every transport), cyberscoop and technadu feeds (10 items, 2026-10-25 to 10-27 not listed), F5 K000163821 and the per-product Broadcom advisories (JS shell or login), apa-ots (feed about 3 h deep), risikomonitor.ch (no DNS from the container).
2026-11-01T0256Z-intel· Sonnet 5.5 · window 26 h · 1 entry published
Verification & coverage notes
Window: standard class, gap 24.0 h to 2026-10-31T0256Z-intel, window 26 h. The window is a Saturday and a Sunday: every authority and trade feed in the slices has its newest item on 2026-10-30 or earlier (NCSC.ch security hub 2026-10-30T14:22Z, BACS pages 2026-10-27 and older, NCSC-NL, BSI, CERT-EU, CERT.at, CERT-PL, ENISA, NCSC-UK, CISA, Inside IT, Netzwoche). A thin window is the healthy outcome here, not a miss.
KEV sweep: kev_window_diff.py found no CISA KEV additions inside the window, and S1's own read of catalog 2026.10.30 agrees (the newest additions, the two Ivanti flaws of 2026-10-30, are covered). No KEV row needs a disposition.
Backlog: the ARX Group SA / Aurora row stays held. S4 re-checked on 2026-11-01 (DE, FR, IT and EN searches; Inside IT through 2026-10-30; the tio.ch, SRF, RTS, Netzwoche, ICTjournal and Blick listings; the arx.ing homepage) and found no statement from ARX, SBB, ASTRA or Swiss press; Ransomware.live still shows the bare claim with no press link. The row's expiry stays 2026-11-07, struck if the condition is unmet.
Dispositions (PD-8): the PAN-OS naming and the Unit 42 verification are an update on 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release; the Fragnesia entry carried the same stale "one unnamed vendor" statement and takes an improvement that names the vendor without re-floating it; the PHP2Shell main entry takes an update that names the vendor and adds GreyNoise's sensor data and Hunt.io's captures (follow-up FU1, spawned on the verifier's missed-angle finding). GTIG and Mandiant's incident-response report is an update on the ARTEX entry; Microsoft's trust-list removal, Cisco's advisory v1.5 and GitLab's release are an update on the eMudhra entry.
Recency (PD-7): the PAN-OS update rests on Dream Research (2026-10-29) and Unit 42 (2026-10-29), and the eMudhra update on Microsoft (2026-10-26), GitLab (2026-10-29), Python (2026-10-26) and Cisco v1.5 (2026-10-30), all dated before the 26 h horizon of 2026-10-31T00:56Z and none carried by the previous fire. They are admitted as first coverage from rotational sources' lookback (Dream through S3, GitLab through S1) and as changelog records on covered entries that predate them, each moving what a reader does (the post-patch compromise check and the Windows trust-list removal). The GreyNoise tracker (2026-11-01) and Hunt.io (2026-10-28, revised 2026-10-30) additions to the PHP2Shell entry come from the FU1 follow-up. The GTIG report is in window.
Sourcing: the Vaud entry is single-source-victim; RTS repeats the canton's release and adds a pupil suspicion without a further named source, which the entry attributes to RTS. The PAN-OS entry moves from single-source to multi-source (Dream Research and Unit 42 describe the chain; the two worked together, so credibility stays 2 and the actor claim rests on Dream's relay of Unit 42's CL-UNK-1280 designation). Hunt.io's PAN-OS rooting sentence relays Dream and Unit 42 and is not an independent vantage.
Source inconsistencies carried: GTIG's introduction lists ARTEX, Hexstrike and CAIRN while its observations list ARTEX, PentAGI and CAIRN (sourcing note of the ARTEX entry). Dream says the PAN-OS management web server also fronts the GlobalProtect portal, while Palo Alto's advisory says GlobalProtect is not affected; the entry states both, attributed (see the Contradiction line). Dream's page title counts 25 servers where earlier text counted 24 (24 batch-rooted firewalls plus the internal management server).
Contradiction: Dream says the PAN-OS management web server also fronts the GlobalProtect portal; Palo Alto's advisory says GlobalProtect is not affected. The PAN-OS entry states both, attributed. Hunt.io says PAN-OS runs one uniform PHP 8.0.30 build and that the exploit reliably roots it; Dream lists PHP 7.4.33 on PAN-OS 11.1 and 24 rooted of 240 targeted. The entries carry Dream's version and count only.
borderline-drop: ESET APT Activity Report Q2 to Q3 2026: no Swiss or public-sector finding beyond the MDaemon item already covered.
borderline-drop: Talos VOLTA and NIK C2 (AI-integrated implants): effort-displacement novelty with no decision change; NIK C2 is also outside the window.
borderline-drop: Kaspersky NetamLoader: one Asian victim, no attribution, no constituency nexus.
borderline-drop: Check Point Yoba: XMRig miner payload through fake AI-app repositories, no nexus.
borderline-drop: Binance USD 6.36 billion theft: passes only the global-scale clause, no Swiss nexus, and the vector is one clause (a DevOps laptop and a service container) with no transferable technique detail.
borderline-drop: Chainalysis intrusion: method undisclosed, no Swiss customer named (incident floor).
borderline-drop: Northflank environment-variable exposure: no Swiss or public-sector nexus.
borderline-drop: Node2Shell vendor-list additions (Cisco still investigating, Prisma Cloud Transporter Client 0.2.9, Stormshield Management Center 3.9.4): marginal product-list additions on a covered entry.
borderline-drop: Android SMS of Death (CVE-2026-58882): denial of service only, and the CVE id comes from BleepingComputer alone with no NVD or EUVD record on 2026-11-01.
borderline-drop: TeamViewer TV-2026-1011 (CVE-2026-111585 and two more, fixed in 15.83): a user-interaction flaw that needs the viewer to connect to a hostile host, no exploitation known, patchable in the normal cycle; the sources date from 2026-10-28 to 2026-10-30.
borderline-drop: Sophos GOLD OGRE/Aur0ra AI-agent ransomware and Microsoft's North Korean AI-adoption post: no constituency decision.
borderline-drop: SIHF portal credential-abuse breach, Holcim leak-site claim, SALEG and INED claims, Oberspreewald-Lausitz district administration: no Swiss public-sector nexus or no victim confirmation.
Carry-forward for the next fire (S1): Cisco's advance notice of 2026-10-28 says advisories for ISE, UCS Central and Unified CM publish on 2026-11-04.
Candidate source added: vd-ch-press-releases (primary for cantonal disclosures; both S2 and S4 proposed it). Proposed and not added, to keep to about one per run: letemps-cyber, ms-trusted-root-program, remedio-research, php.events.greynoise.io (GreyNoise's per-flaw event tracker, worth a per-fire check while a flaw is in KEV). Recipe findings are in the sources_changed notes: mandiant-gtig (the FeedBurner feed lags and missed the 2026-10-31 post), enisa-euvd, lab52, swissinfo-ger, phorion.
Coverage gaps: connectwise-trust-center (403 on every transport); ox-security (article bodies 403); lab52 (feed SSL EOF, listing read through the reader, nothing in horizon); Tamedia pages (tagesanzeiger.ch, 24heures.ch) fall to the metered reader or return page chrome.
Watchlist: not configured (product, supplier and standing-interest lists empty).
Source-health repairs of this fire (UNSOLVED list): sans-isc now reads its feed (fetch_method rss, health_cmd feed), frenchbreaches gets a feed health_cmd, vd-ch-press-releases is content_scope: general-news; ico-uk stays flagged needs-demote because the direct sitemap read, extract and WebFetch all timed out today, a transport timeout that never demotes (the recipe worked on 2026-10-22 and 2026-10-27).
Verifier iteration 1 (NEEDS_FIXES, 23 findings) was remediated before iteration 2; its follow-up research FU1 ran on the missed-angle finding. The run's own verification block carries the outcomes.
Verification: eight iterations, the cap. Iteration 1 returned NEEDS_FIXES with 23 findings and iteration 5 a first CLEAN (three advisories left); the confirmation pass, iteration 6, returned NEEDS_FIXES (two truth findings, both fixed), and iterations 7 and 8 returned NEEDS_FIXES on small wording, date and citation defects. The loop ended at the cap and publishes under the fail-open rule with verification_residual_count 3, the truth and editorial findings of iteration 8. Those three (a Threat ID range on the PAN-OS entry, an OpenJDK citation date on the eMudhra entry, a "first documented code execution" claim on the PHP2Shell entry) were corrected after the last pass and are not re-verified; the next quality audit should give those three entries an independent read.